@mushi-mushi/mcp 0.17.0 → 0.18.0

package/dist/{chunk-ZX3XIJ7S.js → chunk-VBXXUK5G.js}

@@ -11,6 +11,7 @@ var FEATURE_GROUPS = [
   "audit",
   "docs",
   "usage",
+  "codebase",
   /** Deprecated aliases kept for one release — hidden unless `legacy` or `all`. */
   "legacy"
 ];
@@ -40,21 +41,16 @@ var TOOL_FEATURE_MAP = {
   triage_issue: "triage",
   query_lessons: "triage",
   list_lessons: "triage",
-  fix_suggest: "triage",
-  graph_neighborhood: "triage",
-  graph_node_status: "triage",
-  get_reporter_thread: "legacy",
+  suggest_fix: "triage",
+  get_graph_neighborhood: "triage",
+  get_graph_node: "triage",
   // inventory
-  inventory_get: "inventory",
-  inventory_diff: "inventory",
-  inventory_findings: "inventory",
+  get_inventory: "inventory",
+  diff_inventory: "inventory",
+  list_gate_findings: "inventory",
   inventory_current: "admin",
   // setup
-  diagnose_connection: "setup",
   diagnose_setup: "setup",
-  setup_check: "legacy",
-  ingest_setup_check: "legacy",
-  get_activation_status: "legacy",
   activation_status: "setup",
   project_integration_health: "setup",
   setup_repo_for_mushi: "setup",
@@ -107,14 +103,31 @@ var TOOL_FEATURE_MAP = {
   // audit
   run_fullstack_audit: "audit",
   get_backend_health: "audit",
+  // codebase understand
+  ask_codebase: "codebase",
+  get_file_summary: "codebase",
+  get_codebase_tour: "codebase",
+  search_codebase: "codebase",
+  get_codebase_domains: "codebase",
+  analyze_codebase_impact: "codebase",
+  analyze_wiki_knowledge: "codebase",
   // docs
   search_mushi_docs: "docs"
 };
 var DEPRECATED_TOOL_ALIASES = {
+  // Removed deprecated tools → successor.
   setup_check: "diagnose_setup",
   ingest_setup_check: "diagnose_setup",
+  diagnose_connection: "diagnose_setup",
   get_activation_status: "activation_status",
-  get_reporter_thread: "get_report_timeline"
+  get_reporter_thread: "get_report_timeline",
+  // Renamed to verb_object → new name.
+  fix_suggest: "suggest_fix",
+  inventory_get: "get_inventory",
+  inventory_diff: "diff_inventory",
+  inventory_findings: "list_gate_findings",
+  graph_neighborhood: "get_graph_neighborhood",
+  graph_node_status: "get_graph_node"
 };
 function parseFeaturesParam(raw) {
   if (raw == null || raw.trim() === "") return "all";
@@ -122,7 +135,12 @@ function parseFeaturesParam(raw) {
   if (normalized === "all" || normalized === "*") return "all";
   const groups = normalized.split(",").map((s) => s.trim()).filter(Boolean);
   const valid = groups.filter((g) => FEATURE_GROUPS.includes(g));
-  if (valid.length === 0) return "all";
+  if (valid.length === 0) {
+    console.warn(
+      `[mushi-mcp] MUSHI_FEATURES="${raw}" contains no recognised groups; falling back to DEFAULT_FEATURE_GROUPS. Valid groups: ${FEATURE_GROUPS.join(", ")}`
+    );
+    return DEFAULT_FEATURE_GROUPS;
+  }
   return valid;
 }
 function parseFeaturesCsv(raw) {

package/dist/clients.d.ts

@@ -1,3 +1,5 @@
+import { FeatureGroup } from './feature-groups.js';
+
 /**
  * FILE: packages/mcp/src/clients.ts
  * PURPOSE: Shared, pure (React-free) client registry + install-config builders for
@@ -37,6 +39,7 @@
  * - Windsurf uses `serverUrl` for remote HTTP (NOT `url`) — encoding both would break it.
  * - The `cliIde` field drives `mushi setup --ide <cliIde>` in the CLI lane.
  */
+
 interface StdioConfig {
     command: string;
     args: string[];
@@ -61,6 +64,19 @@ interface McpBuildInput {
     endpoint: string;
     /** Hosted Streamable HTTP MCP URL (`RESOLVED_MCP_HTTP_URL`). */
     mcpHttpUrl: string;
+    /**
+     * Restrict the exposed tool groups. Omitted → each client's existing default
+     * (the lean `DEFAULT_FEATURE_GROUPS` for stdio deeplinks; all tools for the
+     * config-json clients that historically set no `MUSHI_FEATURES`). The public
+     * keyless demo passes an explicit read-only subset here.
+     */
+    features?: readonly FeatureGroup[];
+    /**
+     * Hosted HTTP transport only: append `?read_only=1` so the server hides and
+     * blocks write tools regardless of key scope. Used by the public demo on top
+     * of an `mcp:read` key for defence in depth. No-op for stdio configs.
+     */
+    readOnly?: boolean;
 }
 type McpBuildResult = {
     kind: 'deeplink';
@@ -91,7 +107,7 @@ interface McpClientDef {
 /** Build a stable, unique, human-readable MCP server slug for a project. */
 declare function projectServerName(projectId: string, projectName: string): string;
 declare function buildStdioConfigObj(projectId: string | undefined, apiKey: string, apiEndpoint: string, features?: readonly string[]): StdioConfig;
-declare function buildHttpConfigObj(projectId: string | undefined, apiKey: string, mcpHttpUrl: string, features?: readonly string[]): HttpConfig;
+declare function buildHttpConfigObj(projectId: string | undefined, apiKey: string, mcpHttpUrl: string, features?: readonly string[], readOnly?: boolean): HttpConfig;
 declare const MCP_CLIENTS: McpClientDef[];
 /** Look up a client by id — throws if not found. */
 declare function getMcpClient(id: McpClientId): McpClientDef;

package/dist/clients.js

@@ -1,11 +1,11 @@
 import {
   MUSHI_ICON_PNG_URL
-} from "./chunk-EHB2BGWX.js";
+} from "./chunk-EANW5YTI.js";
 import {
   DEFAULT_FEATURE_GROUPS,
   appendFeaturesToUrl,
   featuresQueryString
-} from "./chunk-ZX3XIJ7S.js";
+} from "./chunk-VBXXUK5G.js";
 
 // src/clients.ts
 function projectServerName(projectId, projectName) {
@@ -27,8 +27,17 @@ function buildStdioConfigObj(projectId, apiKey, apiEndpoint, features = DEFAULT_
     icon: MUSHI_ICON_PNG_URL
   };
 }
-function buildHttpConfigObj(projectId, apiKey, mcpHttpUrl, features = DEFAULT_FEATURE_GROUPS) {
-  const url = appendFeaturesToUrl(mcpHttpUrl, features);
+function withReadOnly(baseUrl, readOnly) {
+  if (!readOnly) return baseUrl;
+  const url = new URL(baseUrl);
+  url.searchParams.set("read_only", "1");
+  return url.toString();
+}
+function buildHttpConfigObj(projectId, apiKey, mcpHttpUrl, features = DEFAULT_FEATURE_GROUPS, readOnly = false) {
+  const url = withReadOnly(
+    appendFeaturesToUrl(mcpHttpUrl, features),
+    readOnly
+  );
   const headers = {
     Authorization: `Bearer ${apiKey}`,
     "X-Mushi-Api-Key": apiKey
@@ -57,9 +66,9 @@ var MCP_CLIENTS = [
     method: "deeplink",
     transport: "stdio",
     cliIde: "cursor",
-    build({ projectId, projectName, apiKey, endpoint }) {
+    build({ projectId, projectName, apiKey, endpoint, features }) {
       const name = projectId ? projectServerName(projectId, projectName) : `mushi-${projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 24)}`;
-      const config = buildStdioConfigObj(projectId, apiKey, endpoint);
+      const config = buildStdioConfigObj(projectId, apiKey, endpoint, features);
       return { kind: "deeplink", url: encodeCursorDeeplink(name, config) };
     }
   },
@@ -70,9 +79,9 @@ var MCP_CLIENTS = [
     description: "One-click install via VS Code MCP extension",
     method: "deeplink",
     transport: "stdio",
-    build({ projectId, projectName, apiKey, endpoint }) {
+    build({ projectId, projectName, apiKey, endpoint, features }) {
       const name = projectId ? projectServerName(projectId, projectName) : `mushi-${projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 24)}`;
-      const config = buildStdioConfigObj(projectId, apiKey, endpoint);
+      const config = buildStdioConfigObj(projectId, apiKey, endpoint, features);
       return { kind: "deeplink", url: encodeVsCodeDeeplink("vscode", name, config) };
     }
   },
@@ -83,9 +92,9 @@ var MCP_CLIENTS = [
     description: "One-click install via VS Code Insiders MCP extension",
     method: "deeplink",
     transport: "stdio",
-    build({ projectId, projectName, apiKey, endpoint }) {
+    build({ projectId, projectName, apiKey, endpoint, features }) {
       const name = projectId ? projectServerName(projectId, projectName) : `mushi-${projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 24)}`;
-      const config = buildStdioConfigObj(projectId, apiKey, endpoint);
+      const config = buildStdioConfigObj(projectId, apiKey, endpoint, features);
       return { kind: "deeplink", url: encodeVsCodeDeeplink("vscode-insiders", name, config) };
     }
   },
@@ -96,9 +105,12 @@ var MCP_CLIENTS = [
     description: "Copy config into ~/.codeium/windsurf/mcp_config.json",
     method: "config-json",
     transport: "http",
-    build({ projectId, projectName, apiKey, mcpHttpUrl }) {
+    build({ projectId, projectName, apiKey, mcpHttpUrl, features, readOnly }) {
       const name = projectId ? projectServerName(projectId, projectName) : `mushi-${projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 24)}`;
-      const url = appendFeaturesToUrl(mcpHttpUrl, DEFAULT_FEATURE_GROUPS);
+      const url = withReadOnly(
+        appendFeaturesToUrl(mcpHttpUrl, features ?? DEFAULT_FEATURE_GROUPS),
+        readOnly
+      );
       const headers = {
         Authorization: `Bearer ${apiKey}`,
         "X-Mushi-Api-Key": apiKey
@@ -124,12 +136,13 @@ var MCP_CLIENTS = [
     description: "Copy config into cline_mcp_settings.json",
     method: "config-json",
     transport: "stdio",
-    build({ projectId, projectName, apiKey, endpoint }) {
+    build({ projectId, projectName, apiKey, endpoint, features }) {
       const name = projectId ? projectServerName(projectId, projectName) : `mushi-${projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 24)}`;
       const env = {
         MUSHI_API_ENDPOINT: endpoint,
         MUSHI_API_KEY: apiKey
       };
+      if (features) env.MUSHI_FEATURES = featuresQueryString(features);
       if (projectId) env.MUSHI_PROJECT_ID = projectId;
       const clineConfig = {
         mcpServers: {
@@ -152,9 +165,12 @@ var MCP_CLIENTS = [
     method: "cli-command",
     transport: "http",
     cliIde: "claude",
-    build({ projectId, projectName, apiKey, mcpHttpUrl }) {
+    build({ projectId, projectName, apiKey, mcpHttpUrl, features, readOnly }) {
       const name = projectId ? projectServerName(projectId, projectName) : `mushi-${projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 24)}`;
-      const url = appendFeaturesToUrl(mcpHttpUrl, DEFAULT_FEATURE_GROUPS);
+      const url = withReadOnly(
+        appendFeaturesToUrl(mcpHttpUrl, features ?? DEFAULT_FEATURE_GROUPS),
+        readOnly
+      );
       const cmd = `claude mcp add --transport http ${name} "${url}" --header "Authorization: Bearer ${apiKey}"`;
       return { kind: "command", text: cmd };
     }
@@ -166,12 +182,13 @@ var MCP_CLIENTS = [
     description: "Copy config into claude_desktop_config.json",
     method: "config-json",
     transport: "stdio",
-    build({ projectId, projectName, apiKey, endpoint }) {
+    build({ projectId, projectName, apiKey, endpoint, features }) {
       const name = projectId ? projectServerName(projectId, projectName) : `mushi-${projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 24)}`;
       const env = {
         MUSHI_API_ENDPOINT: endpoint,
         MUSHI_API_KEY: apiKey
       };
+      if (features) env.MUSHI_FEATURES = featuresQueryString(features);
       if (projectId) env.MUSHI_PROJECT_ID = projectId;
       const desktopConfig = {
         mcpServers: {
@@ -193,12 +210,13 @@ var MCP_CLIENTS = [
     method: "config-json",
     transport: "stdio",
     cliIde: "zed",
-    build({ projectId, projectName, apiKey, endpoint }) {
+    build({ projectId, projectName, apiKey, endpoint, features }) {
       const name = projectId ? projectServerName(projectId, projectName) : `mushi-${projectName.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 24)}`;
       const env = {
         MUSHI_API_ENDPOINT: endpoint,
         MUSHI_API_KEY: apiKey
       };
+      if (features) env.MUSHI_FEATURES = featuresQueryString(features);
       if (projectId) env.MUSHI_PROJECT_ID = projectId;
       const zedConfig = {
         context_servers: {
@@ -226,8 +244,11 @@ var MCP_CLIENTS = [
     description: "Streamable HTTP URL \u2014 works with OpenClaw, Hermes, Gemini CLI, ChatGPT, and more",
     method: "remote-url",
     transport: "http",
-    build({ projectId, apiKey, mcpHttpUrl }) {
-      const url = appendFeaturesToUrl(mcpHttpUrl, DEFAULT_FEATURE_GROUPS);
+    build({ projectId, apiKey, mcpHttpUrl, features, readOnly }) {
+      const url = withReadOnly(
+        appendFeaturesToUrl(mcpHttpUrl, features ?? DEFAULT_FEATURE_GROUPS),
+        readOnly
+      );
       const headerSnippet = [
         `Authorization: Bearer ${apiKey}`,
         projectId ? `X-Mushi-Project-Id: ${projectId}` : ""

package/dist/feature-groups.d.ts

@@ -4,14 +4,20 @@
  * When `features` is omitted → all tools (backward compatible).
  * New installs default to DEFAULT_FEATURE_GROUPS via deeplink / docs.
  */
-declare const FEATURE_GROUPS: readonly ["triage", "fixes", "inventory", "setup", "qa", "skills", "rewards", "admin", "audit", "docs", "usage", "legacy"];
+declare const FEATURE_GROUPS: readonly ["triage", "fixes", "inventory", "setup", "qa", "skills", "rewards", "admin", "audit", "docs", "usage", "codebase", "legacy"];
 type FeatureGroup = (typeof FEATURE_GROUPS)[number];
 /** Lean default for new Cursor installs (~45 tools vs 70 full). */
 declare const DEFAULT_FEATURE_GROUPS: readonly FeatureGroup[];
 declare const ALL_FEATURE_GROUPS: readonly FeatureGroup[];
 /** Map every tool/resource name → feature group. */
 declare const TOOL_FEATURE_MAP: Record<string, FeatureGroup>;
-/** Tools superseded by another — still registered when legacy/all enabled. */
+/**
+ * Tools that were renamed or removed. The old name maps to its successor so
+ * callers / docs can resolve the new tool, and a one-release deprecation
+ * window keeps old agent configs from silently breaking. These names are NOT
+ * registered as tools; the map exists so the CLI, docs, and helpful-error
+ * paths can point users at the replacement.
+ */
 declare const DEPRECATED_TOOL_ALIASES: Record<string, string>;
 type FeatureFilter = 'all' | readonly FeatureGroup[];
 declare function parseFeaturesParam(raw: string | null | undefined): FeatureFilter;

package/dist/feature-groups.js

@@ -9,7 +9,7 @@ import {
   parseFeaturesCsv,
   parseFeaturesParam,
   toolMatchesFeatures
-} from "./chunk-ZX3XIJ7S.js";
+} from "./chunk-VBXXUK5G.js";
 export {
   ALL_FEATURE_GROUPS,
   DEFAULT_FEATURE_GROUPS,